Infoblox - IQ for TD Detected Insights - API Source

Status: available
Severity: medium
Time window: 1d
Group by: InfobloxInsightID
Source: github.com/Azure/Azure-Sentinel

'Infoblox IQ for TD Insight detected in logs sourced via REST API. Customize scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called InfobloxInsight.'

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1498` Network Denial of Service `T1565` Data Manipulation

Rule body

id: a5e2df87-f0c9-4540-8715-96e71b608986
name: Infoblox - IQ for TD Detected Insights - API Source
description: |
  'Infoblox IQ for TD Insight detected in logs sourced via REST API. Customize scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxInsight**](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Infoblox/Parsers/InfobloxInsight.yaml).'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: InfobloxSOCInsightsDataConnector_API
    dataTypes: 
      - InfobloxInsight
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1498
  - T1565
query: |
  InfobloxInsight
  | summarize arg_max(TimeGenerated, *) by InfobloxInsightID
  | where DataObservedVia != "CDC" and InsightDetail != true
  | extend ThreatProperties = strcat_array(ThreatProperties, ", ")
entityMappings:
  - entityType: Malware
    fieldMappings:
      - identifier: Name
        columnName: Name
      - identifier: Category
        columnName: ThreatProperties
customDetails:
  InfobloxInsightID: InfobloxInsightID
  Severity: Priority
  Status: Status
  FirstSeen: FirstSeen
  EvaluationStartDate: EvaluationStartDate
  EvaluationEndDate: EvaluationEndDate
  TotalHits: EventsCount
  TotalAssets: TotalAssets
  TotalIndicators: TotalIndicators
  ThreatActor: ThreatActor
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Infoblox - IQ for TD Insight - {{Name}}'
  alertDescriptionFormat: 'Observed via API. {{Description}} Observation: {{FirstSeen}}'
  alertSeverityColumnName: IncidentSeverity
incidentConfiguration:
  createIncident: true
version: 1.1.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

InfobloxInsight

Stage 2: `summarize`

| summarize arg_max(TimeGenerated, *) by InfobloxInsightID

Stage 3: `where`

| where DataObservedVia != "CDC" and InsightDetail != true

Stage 4: `extend`

| extend ThreatProperties = strcat_array(ThreatProperties, ", ")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DataObservedVia`	ne	`CDC`	`field:"DataObservedVia" kind:ne value:"CDC"`
`InsightDetail`	ne	`true`	`field:"InsightDetail" kind:ne value:"true"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`InfobloxInsightID`	`summarize`
`ThreatProperties`	`extend`